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Abstract. The cloning of quantum variables with continuous spectra is investigated. We define a Gaussian 
l-to-2 cloning machine, which copies equally well two conjugate variables such as position and momentum 
or the two quadrature components of a light mode. The resulting cloning fidelity for coherent states, namely 
F = 2/3, is shown to be optimal. An asymmetric version of this Gaussian doner is then used to assess 
the security of a continuous-variable quantum key distribution scheme that allows two remote parties to 
share a Gaussian key. The information versus disturbance tradeoff underlying this continuous quantum 
cryptographic scheme is then analyzed for the optimal individual attack. Methods to convert the resulting 
Gaussian keys into secret key bits are also studied. The extension of the Gaussian doner to optimal N-to- 
M continuous doners is then discussed, and it is shown how to implement these doners for light modes, 
using a phase-insensitive optical amplifier and beam splitters. Finally, a phase-conjugated inputs (N,N')~ 
to-(M, M') continuous doner is defined, yielding M clones and M' anticlones from TV replicas of a coherent 
state and N' replicas of its phase-conjugate (with M' — M = N' — N). This novel kind of doners is shown 
to outperform the standard N-to-M doners in some situations. 

PACS. 03.67.Dd - 03.65.Bz - 42.50.-p - 89.70.+C 



1 Introduction 

Quantum information theory was originally developed for 
discrete quantum variables, in particular quantum bits 
(qubits). Recently, however, it has been discovered that 
several concepts that were invented for qubits extend very 
naturally to the domain of continuous variables (e.g., posi- 
tion and momentum of a particle, or the quadrature com- 
ponents of a mode of the electromagnetic field) . The first 
result in this direction concerned quantum teleportation 
p4,R, and gave rise to a lot of interest in continuous- 
variable quantum information processing. In the present 
paper, we focus on the notions of quantum cloning and 
quantum key distribution, and investigate how they can 
be extended to continuous variables. 

Cloning machines (that achieve the optimal approxi- 
mate cloning transformation compatible with the so-called 
no-cloning theorem) have been a fundamental research 
topic in the last five years. In Section g, we will define 
a Gaussian doner, which achieves the optimal cloning of 
a continuous variable compatible with the requirement of 
being covariant with respect to displacements and rota- 
tions in phase space. In other words, this doner dupli- 
cates all coherent states with a same fidelity (F = 2/3). 
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The optical implementation of this doner and its exten- 
sion to TV-to-M doners are also discussed. In Section H, 
we then turn to quantum key distribution, and propose a 
continuous-variable cryptosystem that allows two remote 
parties to share a Gaussian key by exchanging continuous 
key elements carried by squeezed states. This scheme is 
the proper continuous counterpart of the protocol BB84 
[0 for qubits. Our continuous cryptosystem is related to 
the Gaussian doner for an asymmetric version of the lat- 
ter achieves the optimal individual eavesdropping strat- 
egy. Thus, our previous results on continuous cloning can 
be used to analyze the information versus disturbance 
tradeoff, in order to assess the security of this continu- 
ous cryptosystem. We find that the information gained by 
the eavesdropper is exactly upper bounded by the infor- 
mation lost by the authorized receiver. We also investigate 
a protocol to convert the raw Gaussian keys into a string 
of secret key bits, that is, we show how to apply recon- 
ciliation and privacy amplification on continuous key el- 
ements. Finally, in Section [|, we come back to the issue 
of cloning continuous variables, and define a new class of 
"phase-conjugated inputs" doners. These doners produce 
several clones (and anticlones) from several replicas of an 
input coherent state and its phase conjugate. We show 
that adding these extra phase-conjugated inputs makes it 
possible to improve the cloning (and anticloning) fidelity 
with respect to the standard N-to-M doners. 
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2 Quantum Cloning Machines 

Let us first seek for a transformation which duplicates 
with a same fidelity all coherent states \ip) 1 with ip = 
(x + ip)/\/2. The fundamental requirement we put on this 
transformation is that it is covariant with respect to dis- 
placements in phase space. That is, if two input states are 
identical up to a displacement D(x,p) = e ~ lx v e l v x ^ then 
their respective copies should be identical up to the same 
displacement. (In this paper, we put h = 1). Thus, de- 
noting by H the Hilbert space corresponding to a single 
copy, cloning can be defined as a completely positive trace- 
preserving linear map C : H ->■ H® 2 : \^} (ip\ ^ C (\ip) (ip\) 
such that 



C(D(x,p)\i(>){il>\DHx,p)) 
D* a (x,p)e(\il>){1>\)& 92 (.x,p), 



(1) 



for all displacements D{x,p) in the phase space. A sim- 
ple way to meet displacement covariance is to seek for 
a cloning transformation whose output clone individual 
states are given each by a Gaussian mixture: 



pmm = 



i 



dx dp e 



2wa 2 
xt>(x,p)\il>)(il>\&{x,p), 



(2) 



where a 2 is the cloning-induced error variance. In the fol- 
lowing we will refer to such a transformation as a Gaussian 
doner. Note that Eq. (g) is such that the cloning induced 
noise on the quadratures x or p is invariant under rota- 
tions in the phase space, which is certainly a desirable 
property since it is satisfied by coherent states. Consider 
the following unitary operator: 



£a, 2, 3 



= e -^ 3 - 



C2)Pl, 



-ix 1 (p2+P3) e ~iX2P3 



(3) 



where modes 1, 2 and 3 refer respectively to the origi- 
nal, the additional copy, and an auxiliary mode (also ref- 
ered to as an ancilla). This operator can be used to build 
a Gaussian doner if the additional copy and the ancilla 
are initially prepared in the vacuum state fll2|| . Indeed, it 
is readily checked that this transformation outputs two 
clones whose individual states are Gaussian-distributed, 
as in Eq.(0), with a variance a 2 = 1/2. In particular, 
it copies all coherent states \ip) with the same fidelity 
/ lj2 =_<^(V>M=2/3. 

This machine is optimal in the sense that it is im- 
possible to have cr 2 (l, 2) < 1/2. To prove this, let us con- 
sider the following situation. A coherent state is processed 
through such a doner, the observable x being measured at 
one output clone while the observable p is measured at the 
other output. Let us denote by S 2 and S 2 the respective 
error variances corresponding to this joint measurement. 
From the general theory on the simultaneous measurement 
of conjugate observables [Q, we know that 



Sisi > l. 



(4) 





Pump 

\ 


Vacuum 

I a 3 






a 2 






\ 


\ 


a out 




/ 




u l 


Linear 
Ampli 
(G=2) 


a' 








/ 


BS 








a 3 





Fig. 1. Implementation of a 1 — » 2 cloner using a phase- 
insensitive linear amplifier and a 50 : 50 beam-splitter (BS). 



Using Eq. (g), we get 

(8x 2 + a 2 ){5p 2 + a 2 ) > I, 



(5) 



where Sx 2 (Sp 2 ) is the intrinsic variance of x (p) of the 
input state and a 2 is the cloning-induced variance. Now, 
using the uncertainty principle Sx 2 Sp 2 > 1/4 and the in- 
equality a 2 + b 2 > 2Va 2 6 2 , we conclude that a 2 > 1/2, 
implying that the unitary operator Eq. @ is indeed opti- 
mal to achieve Gaussian cloning p0[. 

A possible implementation of this machine (see Fig. \u) 
consists in processingthe input mode into a linear phase- 
insensitive amplifier M of gain G = 2: 



^out 



= v^ai 



'3- 



a' 3 



\/2a 3 , 



(6) 



with a,j — (£j + ipj)/y/2 denoting the annihilation opera- 
tor for mode j). Then, one produces the two output clones 
by processing the output signal of the amplifier through a 
50 : 50 phase-free beam-splitter: 



1 

V2 



(oi +a 2 ), 



1 



V2 



(«i 



02) 



(7) 



It is readily checked that this scheme leads to an equal 
x-error and p-error variance of 1/2 for both clones, that 
is, it achieves the optimal Gaussian doner. 

We will now present two generalizations of this 1 — > 2 
Gaussian quantum cloning machine. The first one consists 
in a transformation which from N (> 1) original input 
states produces M (> 2) output copies whose individual 
states are again given by an expression similar to Eq.(0), 
but with a different error variance <j 2 n.m- Using an argu- 
ment based on the concatenation of doners, it is possible 



to derive a lower bound on a' 



N.M- 



that is 



1 



1 



O N ,M > ^ - W 

with the corresponding fidelity for coherent states 

MN 



In, 



M 



< 



MN +M-N 



(8) 



(9) 



Again, these bounds can be attained by a transformation 
whose implementation necessitates only a phase- insensitive 
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linear amplifier and beam splitters o. Loosely speaking, 
the procedure consists in concentrating the N input modes 
into a single mode by a network of beam splitters, to 
amplify the resulting mode, and then to distribute the 
output amplified mode into M output modes through a 
second network of beam-splitters. Note that the bounds 
Eq. (||^) can also be derived using techniques similar to 
the ones used for evaluating quantum nondemolition mea- 
surements. This was been done in a paper establishing a 
link between cloning and teleportation for continuous vari- 
ables || . 

The second generalization of the 1 — ► 2 Gaussian quan- 
tum cloning machine we will briefly consider here is the 
case where the x and p quadratures are not treated equally, 
and the case where the two output clones do not have the 
same fidelity. Equation (0) then has to be replaced by 



pmm) = 



^=^= I dx dp e 2 " i < x 
-'■"iKx^V (10) 



xD(x,p)\il>){il>\&(x,p), 



where a 2 x (resp. of ) stands for the cloning-induced error 
variance in the quadrature x (resp. p) for the ith clone. 
In this case, it is possible to prove J12J that the following 
cloning uncertainty relations must hold: 



2 2 
T l,p a 2,x 



> 



> 



1/4, 
1/4. 



(11) 



Asymmetries between the output clones and between 
the x/p variables can be characterized by the following 
two parameters: 



X 



<?2,x 



CTl.p 
Ol,p 



and A 



<J\,x 
Cl,p 



ai,x 

CT2,p 



(12) 



As suggested in |p.6| , asymmetric machines (with \ 7^ 
1) can be implemented by a scheme akin to Fig. ffl in the 
sense that only two beam splitters and a single linear am- 
plifier are needed. We will see in the following section how 
these asymmetric quantum cloning machines can be used 
to assess the security of a continuous-variable quantum 
key distribution protocol. 



3 Quantum Key Distribution 



random key element r that follows a Gaussian distribution 
with mean zero and variance E 2 , and randomly decides to 
encode it into either x (i.e., (x) = r) or p (i.e., (p) = r). An 
eavesdropper ignoring which of these two encoding rules 
is used cannot acquire information without disturbing the 
state. 

Let us now describe the exact nature of the states used 
for encoding each key element. When encoding the value 
r ~ N(0, £ x ) in x, Alice creates a Gaussian state such 
that (x) = r, (p) = 0, Ax 2 = a 2 x and thus Ap 2 = l/4o£. 
Similarly, when the value r ~ AT(0, S p ) is encoded in p, 
the encoding state has (p) = r, (x) = 0, Ap 2 = a 2 and 
thus Ax 2 = 1/4ct 2 . 

On his side, Bob measures either x or p at random. 
Like in BB84, half of the measurements give results that 
are uncorrelated to Alice's values, so half of the samples 
must be discarded when Alice discloses the encoding vari- 
able. Unlike BB84, however, measuring the correct vari- 
able does not yield the exact value of r, even with a 
perfect apparatus, because of the intrinsic noise of the 
Gaussian state. The value r follows a Gaussian distribu- 
tion N(0, S x ,p)i to which some Gaussian noise is added 
N(Q, <J x ,p), thus resulting in a Gaussian distribution with 
variance S 2 + a xp . We can therefore model the trans- 
mission of r as a Gaussian channel with a signal-to-noise 
ratio (SNR) equal to £ 2 x /al or S 2 /a 2 . 

An important requirement of the protocol is to make 
it impossible for Eve to be able to infer which encoding 
variable Alice used. For this, measuring the correct or in- 
correct variable (x or p) must yield statistically indistin- 
guishable results. If, in contrast, Eve was able to detect 
(even not perfectly) that she measured the wrong set, 
then she could fake an attenuation by discarding wrong 
key elements and retransmitting only the correctly mea- 
sured ones. This indistinguishability requirement can be 
expressed as the equality of the density matrices resulting 
from the two encoding rules, or equivalently as (13] 



i S l 

1 + Hr 



!+-£ = 



1 



4cr 2 CT 2 ' 



(13) 



A proof of this is given in Appendix H. This also means 
that the SNR is the same for both variables x and p, and 
that the information rate is 11151 



I 



log 2 (l + S 2 Ja 2 x ) 



\og 2 (2a x a p 



(14) 



In this section, we introduce a quantum protocol for the 
distribution of Gaussian key elements, which is a continuous- 
variable analogue of the protocol BB84 B - we assume 
here that the reader is familiar with BB84. Our protocol, 
introduced in |L|, works like BB84 but with binary in- 
formation being replaced by continuous information that 
behaves essentially like in a Gaussian channel. 

One exploits a pair of canonically conjugate continuous 
variables x and p, which can be thought of, for instance, as 
the two quadratures X\ and Xo of the amplitude of a mode 
of the electromagnetic field 122] . Alice randomly chooses a 



3.1 Eavesdropping by cloning 

Let us now discuss an individual eavesdropping of this 
protocol with cloning machines such as those defined in 
Section g. Eve makes two clones of the state sent by Al- 
ice, one of which is transmitted to Bob, and the other is 
measured in the correct variable when Alice reveals the 
encoding rule. This happens to be the optimal individual 
eavesdropping strategy as shown in ]13[ and plfl . 

We use a 1 — > 2 cloning machine, and we keep the 
freedom to make a better clone for Bob or Eve (parameter 
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x) and to get more accuracy in x or p (parameter A). 
The subscripts 1 and 2 for the two copies are replaced 
respectively by B and E for the two recipients. The added 
variances on the clones will be: 

°l, x = \x\ <4, P =2* A _1 - ( 15 ) 

4,x = |x- 1 A,cxl, p = ^- 1 A- 1 . (16) 

Let us calculate the resulting information rates. When 
Bob measures x, the result is affected both by the intrinsic 
fluctuations of x and by the noise induced by the cloning 
operation, thus resulting in a total variance c^ + ^X^. This 
is the noise power in the Gaussian channel representing 
the communication between Alice and Bob through Eve's 
cloning machine. Therefore, the information rate is now 



Ib,x = ^log 2 (l + -5 

2 at 



r. 



\x* 



(17) 



Similarly, one can calculate the new variance on p mea- 
sured by Eve on her clone, namely a 2 + ^x 1 ^ 1 - This 
gives an information rate 



Ie, p = 2 lo g2(! 



r 2 



\x 



L A- 



(18) 



Adding the last two information rates indicates the 
balance between Bob's and Eve's information. Remark- 
ably, the information that Eve gains by using this attack 
on v. is exactly equal to the information that Bob loses on 

I B , x +lE, P = \\og 2 (l + ^f)=I. (19) 

Of course, this balance also works when swapping x and 
p, namely I B , P + Ie.x = I- 

This result is interesting because it allows Bob to bound 
from above the information gained by a possible eaves- 
dropper. Assuming symmetry of the protocol in x and p, 
Bob can estimate I—Ib and is guaranteed that Ie < I—Ib 
(in practice, a part of the information loss will be due to 
channel noise). From Ref. [Eol, it is kwown that with rec- 
onciliation and privacy amplification carried out over a 
public authenticated channel, one is guaranteed to gener- 
ate key bits whenever Ib > Ie- This last condition is in 
turn guaranteed provided that Ib > -f/2, so that up to a 
50% information loss on Bob's side is acceptable in order 
to generate key bits. 



3.2 From Gaussian key elements to secret bits 

Let us now investigate the classical part of the key distri- 
bution protocol since we have to deal with reconciliation 
and privacy amplification based on continuous raw key 
elements here, in contrast to BB84. Shannon's formula 
gives us an upper limit on the number of bits one can 
send through a Gaussian channel with a given SNR. In 



our protocol, neither Alice nor Bob chooses the Gaussian 
random values. Yet, we want them to be able to extract 
a common string of bits out of their correlated Gaussian 
values, revealing as little information as possible on the 
public channel. 

Our secret key distillation procedure [£5| works in the 
following way. First, Alice and Bob are going to extract 
common bits out of their Gaussian-distributed values, us- 
ing a binary correction algorithm such as Cascade or a 
variant |q, 



They will use it several times, on 
several real-to-binary conversion functions. Then, the re- 
sulting bits will undergo the usual privacy amplification 
procedure [g(j,[I|,[|, for instance using a universal class of 
hash functions. 

Let X denote the random variable representing Alice's 
Gaussian values, and X' Bob's values. Alice uses a set of 
real-to-binary conversion functions Si(X) = 0, 1, (1 < i < 
m) . These are called slices, in the sense that instead of per- 
forming reconciliation on the real-valued string X1...1, we 
operate on each string Si(xi...i) sequentially, like slices of 
the main, real- valued string. On his side, Bob uses another 
set of functions Si, called slice estimators, which reflects 
his best guess on the bit Si(X) given his current knowl- 
edge. The slice estimator Si is not only a function of X' 
but also of the previous slices, Si(X', Si(X), . . . ,Si~i(X)). 
This results from the fact that the slices are corrected 
sequentially for i — l,...,m, and thus upon correcting 
slice i Bob already knows S\(X), . . . Si-\(X). By care- 
fully choosing the functions Si and Si, both parties can 
extract a common string of bits out of the correlated 
Gaussian values, while only disclosing a little more than 
H(Si(X), . . . , S m (X)\X') bits on the public channel. A 
more detailed analysis is given in |25|| . 

Let us take an example. Assume the channel has S 2 /a 2 ■■ 
15, which means that Alice and Bob can share up to 
I = \ log 2 (l + S 2 /a 2 ) — 2 bits per raw key element. We 
assume m = 5 slices as a trade-off between the efficiency 
of large m and the use of reasonable computing resources. 
The slice functions Si(X), 1 < i < 5 are constructed in 
the following way. First, the Gaussian distribution of X 
is divided into 2 m = 32 intervals. The interval labeling 
function T(X), which associates an interval number (from 
to 31) to each value of x, is chosen so as to maximize 
I(T(X);X'). Thus, Bob starts with an optimal knowledge 
of T(X). Then, we create the slice functions by assigning 
bit values to each of these intervals. Stated otherwise, we 
create a bijection between Si. ..5(A) and T(X) so that each 
vector of the 5 slice bits represents one (and only one) in- 
terval defined by T(X). Much freedom is permitted at this 
step, but what we found to work best is to assign the least 
significant bit of the interval number to Si(X), the second 
bit to S2{X), and so on up to the most significant bit to 
S 5 (X). 

The slice estimator functions Si. ..5 (X 1 , . . . ) are con- 
structed from the slices Si. ..5 (A) and from the joint prob- 
ability density fx,x'{x,x'). Each estimator Si evaluates 
whether Si(X) — or Si(X) — 1 is more likely condition- 
ally on the arguments given to the estimator, namely X' 
and the previous slices Sj < i(X). 
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In the present example, Alice's and Bob's bits are al- 
most uncorrelated when correcting slices 1 and 2. The bi- 
nary correction algorithm does not have to be used at this 
point - it is enough for Alice to entirely reveal S\(X) and 
S2{X) for the whole string. Then, slice 3 on Alice's side 
and the slice estimator 3 on Bob's side produce two bit 
strings that match 76% of the time - it is thus possible to 
proceed with error correction using a binary correction al- 
gorithm. Note that the bit strings would be less correlated 
if the knowledge of Si(X) and S 2 (X) was not brought to 
Bob. Then for slice 4 (resp. slice 5), Alice's and Bob's 
string match 98% (resp. 99.999%) of the time, for which 
the binary correction will disclose only a small amount 
of information. Again, the knowledge of slices 1-3 helped 
Bob accurately estimate slice 4, which in turn helped him 
estimate slice 5. 

As a result of this 5-step correction, Alice and Bob 
share a string of bits whose entropy is H(Si. ..5) = 4.8 bits 
per raw key element. Assuming a perfect binary correction 
algorithm, about 3 bits per raw key elements were dis- 
closed. Roughly speaking, the net effect is thus 4.8 — 3 = 
1.8 bit of secret information per raw key element after 
privacy amplification (which is to be compared with the 
2 bits per key element as given by Shannon's formula). 

This is of course only an example. More elaborate con- 
structions can be performed, such as gathering d Gaussian 
key elements at once. In fact, it was shown in pa] that 
the disclosed information reaches the Shannon bound as 
d — ► 00, just like for instance data compression works best 
for asymptotically large block sizes. 

Now that we showed how quantum cryptography (fol- 
lowed by reconciliation and privacy amplification) can work 
with continuous variables, let us investigate another appli- 
cation of continuous variables to a special kind of quantum 
cloning machines. 



4 Phase-Conjugated Inputs Quantum Cloning 
Machines 

It has been shown that an antiparallel pair of qubits is in- 
trinsically more informative than a pair of parallel qubits 
if the goal is to encode a direction in space [|l8|. Simi- 
larly for quantum continuous variables, one can show that 
more information can be encoded in a pair of phase- con- 
jugated coherent states \tp) \tp*} than in two identical repli- 
cas \4 ! )H ! ) Hi- Following on these ideas, we present here a 
phase-conjugated input (PCI) quantum cloning machine, 
that is, a transformation which taking as input N replicas 
of a coherent state \ip) and N' replicas of its complex con- 
jugate IV'*)) produces M optimal clones of \ip) uB. Again 
we will require that all the clones are treated equally, and 
that the doner is covariant with respect to both displace- 
ments and rotations in phase space. As a matter of fact, it 
turns out that such a transformation can be implemented 
optimally using a sequence of beam-splitters, a single non- 
linear medium, and another sequence of beam-splitters, 
just as in the case of standard cloning. The procedure is 
the following (see Fig. ||): 



(i) Concentrate the N replicas of \ip) stored in the N 
modes {q} (I = . . . N—l) into a single mode 01, resulting 
in a coherent state of amplitude y/Ntp. This operation can 
be performed with a network of beam-splitters achieving 
a iV-mode Discrete Fourier Transform (DFT)||. We get: 



JV-l 



«i 



— T 



Q. 



(20) 



1=0 



and N—l vacuum modes. Similarly, with a TV-mode DFT, 
concentrate the N' replicas of |"0*) stored in the N' modes 
{di} (I = . . . N' — 1) into a single mode a 2 - This results 
in a coherent state of amplitude \/~Nip*. We have: 



N'-i 



"2 



VN fr? 



(21) 



z=o 



(ii) Apply the following transformation on the modes 
a\ and a 2 , resulting in modes 61 and b 2 defined by 



h = VGai+VG-laJ,, 
b 2 = VG - \a\ + VGa 2 , 



where 



with 



G 



VWW 1 -Vnm 

N'-N ' 



M' - M = N'-N. 



(22) 



(23) 



(24) 



For obvious reasons, we call this transformation a 'phase- 
conjugated input amplification' (PCIA). 

(iii) Distribute the output mode b\ into M clones {c[} 
(l = 0...M-l) with a M-mode DFT: 



(h 



ikl/M 



Vk), 



(25) 



where {ffe} (k = 1...M — 1) denote M — 1 additional 
vacuum modes. It is readily verified that this procedure 
yields M clones of \tp). Interestingly, the amplitude 62 of 
the other output of the PCIA has a mean value ^/M'ip* . 
Therefore, it can be used to produce M' phase-conjugated 
clones (or anti-clones) of \ip), {d[} (1 = 0... M' — 1), using 
a M'-mode DFT: 



d\ 



1 



- 7 (b 2 + e 



inkl/M' 



Wk) 



(26) 



where {wk} (k = 1 . . . M' — 1) denote M' — 1 additional 
vacuum modes. 

Some algebra shows that this procedure is optimal to 
produce M clones, and that the additional M' anti-clones 
are also optimal|jllJ. Furthermore, since the step (ii) of 
our procedure is linear and phase-insensitive, the resulting 
PCI doner is covariant with respect to translations and 
rotations of the state to be copied: all coherent states are 
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lv> _ 



PCIA 



Fig. 2. PCI doner that produces M clones and M' anti-clones 
from N replicas of \ip) and N replicas of |V'*}- Modes are 
concentrated and distributed by Discrete Fourier Transform 
(DFT). 



copied equally well, and the cloning-induced noise is the 
same for all quadratures. 

It is straightforward to calculate the noise of the clones 
and anti-clones: 



1 



't , j\ 



(Mr = M+c , l <c'j-(c' l )(c' l ) = ~ + 



1 G-l 



(Mf 



2 w ' ' " v " v " 2 M 
1 G-l 



M' ' 



(27) 



As expected, the variance of the output clones exceeds 1/2, 
reflecting that perfect cloning (anti-cloning) is indeed im- 
possible. Instead, they suffer from a thermal noise with a 
mean number of photons given by (nth) = [G — 1)/M. In 
other words, their P- function |E2| is a Gaussian distribu- 
tion 



p(tn 



i 



ir{n t h) 



-\i-^/( nth ) 



(28) 



rather than a Dirac distribution P(£, £*) = S^ 2 '(^ — tp). 



4.1 Balanced phase-conjugated inputs doner 

Consider now the balanced case (N — N', M = M'), 
for which simple expressions of the noise variance and 
the fidelity can be obtained. We then have G — (M + 
N) 2 /AMN, giving 



(Mf = (Mf 



and 



f N 
JN.M 



1 



{M-Nf 

ANPN 



4M 2 N 



1 + (nth) 4A/ 2 7V + (M - N) 2 



(29) 



(30) 



Let us compare these quantities to the variance and 
fidelity of a 2N — > M usual cloning machine, as obtained 
by replacing N into 27V in Eqs. (R|) and Eq.(B). Of course, 
in the trivial case where M = 2N, standard cloning can be 
achieved perfectly, while the balanced PCI doner yields an 
additional variance (nth) — 1/(16JV). However, whenever 
M > 2N + 1, the ($) -> M PCI doner outperforms the 
standard 2N — v M cloning machine. Also, comparatively 
more anti-clones with a higher fidelity are produced with 
the PCI doner. Indeed, a standard 2N — > M cloning ma- 
chine produces M — 2JV anti-clones of fidelity 2N/2N + 1, 



which is actually the fidelity of an optimal measurement 
of 2A^ replicas of \ip), whereas a PCI doner produces M 
anti-clones with a higher fidelity, as given by Eq. (pQ). In 
particular, for M — > oo, we see from Eq. (E9) that the ad- 
ditional noise induced by a PCI doner is 1/4 AT, that is, one 
ZiaZ/ of the noise induced by a standard 2N — + oo doner 
(i. e., 1/2N). In this case, the output of the PCIA can be 
considered as classical and the underlying process appears 
to be equivalent to a measurement. This reflects that more 
classical information can be encoded in N pairs of phase- 
conjugated replicas of a coherent state rather than in 2 N 
identical replicas, a result which was proven for N = 1 in 
||. More generally, in the unbalanced case (N ^ N'), it is 
readily checked, using Eq.(|23j), that the optimal measure- 
ment results in a noise that is equal to that obtained by 
measuring (y/N + \fW') 2 identical replicas of the input, 
in the absence of phase-conjugated inputs. 



4.2 Unbalanced phase-conjugated inputs doner 

As we have just shown, the balanced PCI doner results 
in better cloning fidelities than a standard doner. More 
generally, we may ask the following question: in order to 
produce M clones of a coherent state \i[>) from a fixed to- 
tal number n of input modes, N of which being in the 
coherent state \ip) and N' of which being in the phase- 
conjugated state \ip*), what is the phase-conjugate frac- 
tion a — N' jn that minimizes the error variances of the 
clones? 

From Eq. (p2j), we see that for fixed values of the total 
number of input replicas n and number of output clones 
M, the gain G (and thus the noise of the clones (nth)) 
only depends on a and varies as 



G(a) 



2a -1 



(31) 



In Fig. 0, the value of \J(nth) is plotted as a function of 
a for n = 8 and different values of M > n. In the trivial 
case where M = n = 8, the minimum additional vari- 
ance is of course zero, and is obtained for a = 0. The 
cloning transformation is then just the identity. However, 
when M > n + 1, using phase-conjugated input modes 
yields lower variances than standard cloning if a is cor- 
rectly chosen (the lowest variance is then always attained 
for a/ 0). Remarkably, the value of a achieving the mini- 
mum variance is not equal to 1/2 for finite M, that is the 
optimal input partition contains more replicas than anti- 
rcplicas. In the limit of large M, however, the number of 
anti-replicas achieving the lowest variances tends to n/2, 
and the curve G(a) tends to a symmetric curve around 
a = 1/2. This behavior was expected, since M = oo cor- 
responds to a measurement 0,0 and we expect that 
measuring the value of ip from ./V replicas of \tp) and N' 
replicas of \ip*) is equivalent to a cloning transformation 
starting from N' replicas of \ip) and N replicas of \tp*)- 
So, we conclude that the optimal measurement is achieved 
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Fig. 3. Cloning-induced noise standard deviation \/(n t h) as a 
function of the phase-conjugate fraction a = N' /n, for n = 8 
and several values of M/n. 



with balanced inputs (iV = N'), as previously mentioned. 
Finally, in the case where a = 1, the transformation con- 
sists in producing M clones of \ip) from n replicas of IV'*)- 
This is just phase-conjugation, for which we know that 
the best strategy is to perform a measurement ||. The 
additional variance is therefore given by 1/n, which does 
not depend on M. This explains why the curves converge 
all to the same point at a = 1. 



5 Conclusions 

In summary, we have studied continuous-variable cloning 
machines, which produce several copies from one or more 
replicas of an arbitrary coherent state. We have derived 
the optimal fidelity of such doners, as well as the ac- 
tual cloning transformations and the potential methods 
to implement them. We have then proposed a quantum 
key distribution protocol relying on continuous variables, 
and shown how to apply reconcilation and privacy am- 
plification to the generated continuous key elements. We 
have investigated the balance between the information 
gained by the eavesdropper and that received by the au- 
thorized receiver, using cloning as an optimal individual 
eavesdropping strategy. Finally, we have analyzed a new 
class of continuous- variable cloning machines, which ad- 
mit phase-conjugated inputs in addition to the normal in- 
puts. By exploiting the antiunitarity of phase-conjugation, 
these new doners can beat the standard doners in some 
cases. There is in general some non-zero optimal phase- 
conjugate input fraction in order to maximize the cloning 
fidelity. As a conclusion, it should be emphasized that 
these phase-conjugated inputs doners do not extend on a 
qubit-based concept, in contrast with all previously devel- 
oped information-theoretic processes for continuous quan- 
tum variables. Such a qubit doner, admitting additional 
flipped qubits as inputs, has yet to be found. 
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A Density Matrices of Encoding Rules 

In this Appendix, we would like to give further details 
regarding the protocol defined in section 0. In particular, 
we will prove the equality of the density matrices p x and 
p p corresponding to Alice's two encoding rules provided 
that eq. (13|) is verified. 

Define the Gaussian states \ip x (r,a x )) such that (x) = 
r, (p) = 0, Ax 2 = a 2 x and Ap 2 = l/4xr*. Similarly, let 
\ip p (r, a p )) be such that (x) = 0, (p) = r, Ax 2 = l/^cr 2 
and Ap 2 = a 2 With the eigenstates |a;) of x, our states 
have the following scalar products: 



-(x-ry/Aal 



(x\ip x (r,cr x )) = 



(x\ip p (r,o- p )) 



The density matrices p x and p p are defined as: 




(32) 
(33) 



Px = 



dr - 



and 



P P 



S x V2tt 



» e -r 2 /2E 2 p 

dr -j= 

-oo Zjp\ Z7T 



\Mr,cr x ))(iP x (r,a x )\ (34) 



IV'p(^o-p))(V , p(^ cr p)l (35) 



Let us now calculate (x\p x \x') and (x\p p \x') in order to 
show that p x = pp. 

r+oo e -r 2 /2Sl-(x-r) 2 /ial-(x'-r) 2 /4al 

[x\p x \x) = I dr- 



a x S x 2ir 

(36) 

The exponent of e in the above equation can be rewritten 
as 



(r S *( x+X '.) \ 2 2 , a 

V - 2^1+Si)) X 2 +X' 



E 2 x (x-x') 2 



(37) 



After integration, this yields 



x 2 + x' 2 



8o- 2 (a 2 + Z 2 ) 



£ x (x — x ) 



(x\p x \x') = 
For p pi we have 

(x\p p \x') -- 



i(*i+*i) 



2ir^/a 2 x + S 2 



2ttE„ 



(38) 



x e ir ( x ' - x ) e -<? p ( x ~+ x ' ) 

2(7Vi 2 / 2 i /2x s p I t\2 

— p _ c ~ a r( x +x >e — £( x - x ) 



(39) 



2tt 
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Taking (113) into account, we have (x\p x \x') 
for all x, x' . Therefore, p x — p p . 
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